Subject: [XCON] Comments on draft-koskelainen-xcon-xcap-cpcp-usage-00

From: eburger at snowshore.com (Eric Burger)
Date: Mon Jul 14 10:10:10 2003

Second paragraph of the introduction:  What issues do the alternative approaches have?  Who makes a conference application without a user interface?  Who needs this interoperability?  From what element to what element?

Section 6 Open Issue - ad-hoc becomes CPCP
Is this at all a realistic scenario?  By definition, ad-hoc is at the user's phone.  The user owns her phone.  She can do whatever she wants with it.  There is no protocol issue inside a single box.

10. Structure of a Conference Policy document
Is there ANY reason for such a document NOT to be valid?  This MUST be a MUST :-)  The SHOULD is on the implementation: the server SHOULD validate the document, but it doesn't have to if it is too lazy.

Why is <DL> a mandatory element?  Are all conferences dial-out?

11.3 <Conference-time> element
Of course we need times, we have EVERYTHING else here :-(
This whole section recreates iCal.  Let's use iCal.

11.4 <PCL> element
The text should enumerate the algorithm for dealing with conflicting rules here.  I would offer "most-specified" wins.

11.5 <SC>
The text should say that one might want to encrypt SIP bodies for end-to-end security.

11.6 <DL>
Sensible outdialling is a very hard problem.  Retries are easy -- what about failure status, current call attempt status, short retries on busy, abandoning on vacant, long retries on no answer, etc.  This sounds like application logic, not markup.

11.7 <ACL>
Why not do wildcarding in the domain part?  It is just regex processing.  XCAP CPCP is so large already, such that if there was an increase in processing required (which I doubt), it is dwarfed by everything else going on.

The document should point out a denial of service attack, that of filling the ACL table.  This indicates strong authentication and authorization should be part of the protocol.

13. Authorization Policies, last open issue (visibility of information)
These issues are identical to presence information.  How did they solve this problem?

Examples
Open issue on "expel for time period": Too complex and no value.  Application can use its own timer and turn the person in "timeout" back on when appropriate.  That way the application can use maximally complex timeout algorithms without impacting the policy server.